Question

I want to implement a forgot password function in my java web application. I want to implement it like this:

1. User enters their account email address and presses ‘forgot password’ button
2. App generates a unique code of characters and numbers and sends a link with that as a parameter to the user’s email address
3. User clicks the link and they are presented with a form where they can enter their new password

What I want to do is ensure that the link (i.e. the unique code) ‘expires’ an hour after the user presses the forgot password button so that if an attacker gains access to their email account this link won’t work unless they gain access in that first hour.

I don’t know how to make the database ‘expire’ or clear the code for the user’s account record. How could I implement this?

Answer 1

Add a ValidUntil column to the table containing the code and check against that before letting the user change the password.